Skip to content
OpenAdvisories
Medium · 6.5 CVE-2023-37465 GHSA-4j38-rw27-97gx

org.xwiki.contrib:discussions-server has Cross-Site Request Forgery (CSRF) issue that makes it possible to delete messages

Published Jul 27, 2026 · Updated Jul 27, 2026 · Assigned by GHSA

Package: org.xwiki.contrib:discussions-server Ecosystem: Maven

Description

### Impact
It's possible to forge a request to delete a message.

### Patches
The problem has been patched in version 2.0-rc-1 of Discussion Extension.

### Workarounds
There's no easy workaround except upgrading.

### References
https://jira.xwiki.org/browse/DISCUSSION-22

### For more information
If you have any questions or comments about this advisory:
* Open an issue in [Jira XWiki](https://jira.xwiki.org)
* Email us at [security mailing-list](mailto:security@xwiki.org)

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.xwiki.contrib:discussions-server < 2.0-rc-1 2.0-rc-1 GHSA-4j38-rw27-97gx

References